MDSAP: the medical device single audit program explained
MDSAP: one quality system audit recognised by the United States, Canada, Brazil, Australia and Japan. Audit cycle, nonconformity grading and limits.
Key takeaways
- MDSAP (Medical Device Single Audit Program) allows a single audit of a manufacturer's quality system, by a recognised auditing organisation, for five authorities: FDA (United States), Health Canada, ANVISA (Brazil), TGA (Australia) and MHLW/PMDA (Japan).
- The audit is based on ISO 13485:2016 plus the specific requirements of each participating country.
- The cycle lasts three years: initial certification audit, annual surveillance audits, recertification audit.
- Health Canada requires it for class II to IV device licences; the FDA accepts it in place of routine inspections.
- MDSAP does not replace CE marking: the European Union is only an observer.
Selling a medical device in several countries often means undergoing several audits of the same quality system. MDSAP, the Medical Device Single Audit Program, reduces that duplication: a single audit, carried out by a recognised organisation, is accepted by five major authorities. This guide presents how the programme works, its benefits and its limits.
Participating authorities
The programme is run by five member authorities:
| Country | Authority |
|---|---|
| United States | FDA |
| Canada | Health Canada |
| Brazil | ANVISA |
| Australia | TGA |
| Japan | Ministry of Health (MHLW) and PMDA |
Other authorities take part as affiliate members or observers, including the European Union and the World Health Organization, without the MDSAP audit carrying the same weight there.
The principle
An Auditing Organization recognised by the member authorities audits the manufacturer's quality system against:
- ISO 13485:2016, the common foundation;
- the specific requirements of each country the manufacturer targets: for example the QMSR and reporting obligations for the United States, Brazilian good manufacturing practice, Canadian licensing requirements.
The audit report is sent to the authorities, which use it under their own rules.
The audit cycle
- Year 1: initial certification audit, in two stages.
- Years 2 and 3: annual surveillance audits.
- End of cycle: recertification audit, opening a new three-year cycle.
Authorities may also request special or unannounced audits.
Nonconformity grading
MDSAP grades each nonconformity on a scale of 1 to 5, taking into account its impact on device safety and performance and whether it is repeated. The most serious findings, or a significant accumulation, must be reported quickly to the authorities and may trigger action on their part.
What each authority does with it
- Health Canada has required an MDSAP certificate to issue or maintain a class II, III or IV device licence since 1 January 2019.
- The FDA accepts MDSAP reports in place of routine inspections; they replace neither pre-approval inspections nor for-cause inspections.
- ANVISA relies on MDSAP reports in its good manufacturing practice certification procedure.
- The TGA and the Japanese authorities use them as evidence in their own assessments.
Benefits and limits
Benefits:
- one audit instead of several national inspections;
- a predictable schedule;
- a common ISO 13485 foundation, consistent with the US QMSR since 2026.
Limits:
- a longer audit than ISO 13485 alone, since it covers several countries' requirements;
- demanding grading and direct communication with authorities;
- no recognition for CE marking: the MDR and IVDR still require notified body assessment.
Is it worth it?
MDSAP makes sense as soon as a manufacturer targets at least two of the five markets, and it is a must for Canada. For a Europe-focused manufacturer, it complements CE marking without replacing it. Many organisations, notified under the MDR and recognised for MDSAP, offer to combine audits to reduce their total duration.
The five authorities' requirements evolve separately: following them is part of medical device regulatory monitoring for any exporting manufacturer.
Frequently asked questions
What is MDSAP?
The Medical Device Single Audit Program is an international programme allowing a medical device manufacturer's quality management system to be audited once, by a recognised auditing organisation, to meet the requirements of several regulatory authorities.
Which countries recognise MDSAP?
The five member authorities: the FDA in the United States, Health Canada, ANVISA in Brazil, the TGA in Australia and the Japanese Ministry of Health with the PMDA. Other authorities take part as affiliate members or observers, without equivalent recognition.
Is MDSAP mandatory?
In Canada, yes: Health Canada requires an MDSAP certificate for class II, III and IV device licences. Elsewhere it is voluntary but can lighten or replace inspections by the participating authorities.
Does an MDSAP audit replace CE marking?
No. The European Union is only an observer of the programme: CE marking still requires notified body assessment under the MDR or IVDR. The same organisation can however combine audits to limit duplication.
This topic keeps moving. So should your monitoring.
MedQara picks up every new official text (MDCG, EUR-Lex, ANSM, FDA, ISO) and flags what affects your devices. It is medical device regulatory monitoring, filtered on your scope and exportable for your ISO 13485 audits.
Create a free accountKeep receiving this kind of content
Once a week, receive analyses of new ANSM, FDA, EMA, MDR and IVDR publications - straight to your inbox.
No spam. Unsubscribe in 1 click. GDPR compliant.